Privacy Notice – Riftbound Showdown Budapest ticket sales

Effective from 28 October 2026 · Version: 2026-10-28

This is an English translation of the Hungarian text. If the two differ, the Hungarian version prevails. Hungarian original: https://riftbound.delta1.hu/hu/adatkezeles/2026-10-28

This notice describes how we process your personal data when you buy a ticket for the Riftbound Showdown Budapest (28–29 November 2026, World Mall, Budapest; hereinafter: the Event) on https://riftbound.delta1.hu (hereinafter: the Website), or when you use the Website. The notice has been prepared on the basis of Articles 13 and 14 of the European Union's General Data Protection Regulation (Regulation (EU) 2016/679; hereinafter: GDPR). We provide separate information at the venue on the processing of data for on-site registration (Main Event, Side Events) and for ticket purchases at the venue. Point 3.15 covers the players' Riot IDs, which we ask for when you buy tickets.

The language of this notice is Hungarian. An English translation is also published on the Website; in the event of any discrepancy, the Hungarian text prevails.

1. The controller

• Name: Delta Syndicate Kft. (DELTA1, the organiser of the Event and the seller of the tickets; hereinafter: we or the Controller)
• Registered office: 1095 Budapest, Lechner Ödön fasor 1. fsz. 19. ajtó
• Company registration number: 01-09-405118 · Tax number: 32065974-2-43
• For data protection matters: hello@delta1.hu, or by post at the registered office

2. In brief

• You do not need to create an account. To buy, we ask for your name, your e-mail address and your billing details, and for each pass the player's Riot ID, with which we register them in Riot Games' tournament system (point 3.15).
• We do not see or store your bank card details: payment takes place on the payment service provider's page.
• The Website uses only cookies that are necessary for it to work. We measure visits without cookies: the analytics data do not include your IP address, only a fingerprint that is deleted after 30 days (point 3.16). There is no advertising cookie and no other company's tracking code.
• We do not send newsletters, and on the Website we do not ask for your consent to processing for any other purpose either.
• We do not sell your data. We share it only with the service providers needed to complete your purchase and to run the system, and with those to whom we are required to share it by law (for example the invoice data with the tax authority; point 7), and the players' Riot IDs with Riot Games, to register them for the tournament.

3. What data we process, why and for how long

3.1. Ticket purchase and performance of the contract

• Purpose: taking the order, issuing and sending the tickets, communication about the order and the Event, refunds.
• Data: last name, first name, e-mail address, the language of the order, the passes bought (ticket type, quantity, price, how many days they are valid for), the discount code redeemed, the order's number, time and status, the tickets' codes and status. Point 3.15 covers the players' Riot IDs.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Retention period: 5 years after the Event, until claims arising from the contract become time-barred (section 6:22 of the Civil Code (Ptk.)). After that, we anonymise your name and e-mail address. What is needed to support the invoice (the data in point 3.2, and for a private individual the name as well) is kept for the period set out in point 3.2.

If you do not provide this data, we cannot sell you a ticket.

3.2. Invoicing

• Purpose: issuing the invoice and the cancellation (storno) invoice, and meeting our accounting and tax obligations.
• Data: the name on the invoice (your name for a private individual, the company's name for a company), country, postcode, town or city, street address; for a company, the tax number; the items and amounts on the invoice.
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR; sections 159 and 169 of Act CXXVII of 2007 on value added tax; section 169 of Act C of 2000 on accounting).
• Retention period: 8 years after the invoice is issued (section 169(2) of the Accounting Act). The invoice is kept by Számlázz.hu, and a copy of the billing details and the prices remains on the order.
• Recipients: Számlázz.hu, our accountant and, as required by law, the National Tax and Customs Administration (Nemzeti Adó- és Vámhivatal, NAV; point 7).

Providing the billing details is a legal obligation: without them we cannot issue an invoice, and so we cannot sell you a ticket either.

3.3. Payment

• Purpose: payment of the ticket price, verification of the payment, and refunds.
• Data shared: e-mail address, last name, first name, and the order's language, total and number.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Recipient: Paynance and Adyen, which processes the payment (point 7). You give your bank card details to the payment service provider on the payment page; they do not reach us. Paynance also sends you a confirmation e-mail about the successful payment in its own name. Within the scope of their obligations under the laws that apply to them (for example on the prevention of money laundering), the payment service providers may also process the data in accordance with their own privacy notices.
• Retention period: we keep the payment's identifier, time and status together with the order (point 3.1); where they support the payment date on the invoice, for the period set out in point 3.2.

3.4. Declarations at the checkout

• Purpose: proving that you accepted the General Terms and Conditions (hereinafter: the Terms), read the Privacy Notice and, for an age-restricted event, made a declaration about your age.
• Data: the time of the declaration, the version of the accepted Terms and of the acknowledged notice, the language of the order; for an age-restricted event, the declaration that the buyer has reached the age limit.
• Legal basis: performance of the contract and our legitimate interest in the defence of legal claims (Article 6(1)(b) and (f) GDPR).
• Retention period: together with the order (point 3.1).

3.5. Entry control

• Purpose: ensuring that a ticket can be used for entry only once a day, and on no more days than it is valid for, and that a disputed case can be clarified.
• Data: the date and time of the entries made with the ticket, and which member of our staff admitted it. If we reverse an admission because of a mistake (for example because we scanned the wrong ticket), we also log the time of the reversal, the staff member who reversed it and the reason; we do not include your data in the reason. Entry requires the ticket, so we do not look at the buyer's name at the entrance. For a player pass, the scanner also shows the Riot ID that belongs to the ticket, so that our staff member can match the pass to the player (for example when signing up for the tournament; point 3.15). For an age-restricted event, we may check age by asking for an identity document to be shown; we do not record any data about this.
• Legal basis: our legitimate interest in preventing misuse of tickets and in handling disputes (Article 6(1)(f) GDPR).
• Retention period: together with the order (point 3.1).

3.6. E-mails about the order

• Purpose: sending the confirmation with the tickets and the calendar file, the invoice and the storno invoice, the notice about cancellation of the Event and about the refund, and the links requested on the ‘My tickets’ page and the link requested to change a Riot ID (point 3.15).
• Data: e-mail address, first name, the order's details and personal link, the attached tickets (for a player pass the ticket also shows the player's Riot ID) and invoice. The invoice PDF also contains the name and address on the invoice and, for a company, the tax number.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Recipient: the provider of our mail server (point 7).
• Retention period: the Website sends the e-mails through the mail server and does not save copies of them. The mail server logs the technical data of sending (recipient, time); its provider keeps this log in accordance with its own policy, for as long as necessary for the secure operation of the service. If you reply to one of our e-mails, your reply goes to the ticket shop's mailbox (point 3.8).

3.7. The order's personal link and the ‘My tickets’ page

• Purpose: letting you access your tickets at any time without registering, and request a lost confirmation again.
• How it works:
  • The confirmation e-mail contains a personal link. Anyone who opens it sees the order's details, the tickets, and the number and status of the invoice and the storno invoice, so do not share it with others. Your e-mail address appears on the page only in shortened form. By default, the invoice PDF cannot be downloaded from there.
  • We do not store the link in our database, only a fingerprint of it (hash) that can be used for verification but from which the link cannot be reconstructed. The full link appears only in the e-mail sent: it goes into the web server log (point 3.11) without its key.
  • To an e-mail address entered on the ‘My tickets’ page, the system sends new links to the orders belonging to that address (up to 20). Links sent this way earlier then stop working; the link received in the confirmation e-mail remains valid. We do not store the e-mail address entered: we use it only to send the e-mail. To filter out too many requests, we keep its fingerprint in memory for as long as the rate-limiting time window lasts (at most 1 hour); after that it is deleted at the next clean-up.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR).
• Retention period: the link works for as long as we keep the order's data (point 3.1); it stops working when the order is anonymised.

3.8. Customer service and complaints

• Purpose: answering your questions and complaints.
• Data: the data you provide (name, e-mail address, telephone number, order number, the content of the enquiry or complaint), and our reply.
• Legal basis: for complaints, compliance with a legal obligation (Article 6(1)(c) GDPR; section 17/A of Act CLV of 1997 on consumer protection); for other enquiries, performance of the contract or our legitimate interest (Article 6(1)(b) or (f) GDPR).
• Retention period: the record taken of a complaint and the copy of the reply for the 3 years required by law (Article 6(1)(c) GDPR), and for up to 5 years on the basis of our legitimate interest in the enforcement of legal claims (Article 6(1)(f) GDPR); other correspondence for 1 year after the matter is closed.
• Access: we receive enquiries at our customer service address (hello@delta1.hu) and in the ticket shop's mailbox (riftbound@delta1.hu); replies to our e-mails also arrive in the latter. The mailboxes are accessed by the staff members we have authorised, and the ticket shop's mailbox also by our processor that operates the Website. For the latest 200 e-mails in the ticket shop's mailbox, the Website's admin interface shows the sender, the subject, the time of arrival and whether the e-mail has been opened or answered. It does not read the content of the e-mails and saves nothing: the e-mails stay in the mailbox. We log who opened this list and when.

3.9. Refunds

• Purpose: carrying out and recording refunds (an obviously incorrect price, a confirmation not received, tickets that cannot be issued, or an Event that is cancelled or changes; points 4.5, 7.1, 7.2 and 11 of the Terms), and clarifying disputed cases.
• Data: the reason, time and status of the refund, and which member of our staff initiated it. If the refund is made not through the payment service provider but by bank transfer: the date and amount of the transfer and the bank's transaction identifier. You give us the bank account number needed for the transfer (for example by e-mail); we do not record it in the ticket system.
• Legal basis: performance of the contract, compliance with our accounting obligation and our legitimate interest in handling disputes (Article 6(1)(b), (c) and (f) GDPR).
• Retention period: together with the order (point 3.1); what supports the storno invoice, for the period set out in point 3.2. We keep your bank account number only until the transfer has been made, and delete it afterwards.

3.10. Cookies

A cookie is a small data file that a website stores in the browser. The Website uses only cookies that are strictly necessary for it to work. These do not require consent (Article 5(3) of the Directive on privacy and electronic communications, 2002/58/EC), so we do not ask for cookie consent. We do not use analytics, advertising or social media cookies: we measure visits without cookies (point 3.16). We also load the fonts from our own server, so your browser does not connect to any other provider for them either.

Our staff receive further cookies necessary for operation on the admin interface and the internal dashboards (sales, visitors). These are not placed in buyers' browsers:

• payload-token: admin login, 2 hours;
• payload-lng: the admin language, if the staff member switches language, 1 year;
• payload-theme: the admin colour scheme, if the staff member chooses one, 1 year;
• __Secure-riftbound_sales and __Secure-riftbound_visitors: login to the sales and the visitors dashboard (one login sets both), 30 days.

The payment page is Paynance's page, which uses its own cookies in accordance with its own notice.

3.11. Server logs and system security

• Purpose: secure operation of the Website, filtering out abuse (for example mass attempts) and detecting errors.
• Data:
  • in the web server log: the IP address, the time of the request, the address opened (the order's personal link and the Riot ID change link without their keys) and the browser type;
  • to filter out too many attempts: the IP address, in memory only, for as long as the rate-limiting time window lasts (at most 1 hour); after that it is deleted at the next clean-up;
  • in the application log: technical data about operations, for example the order number. We deliberately do not write names, e-mail addresses or card details into the log. Exceptionally, the database error log may also contain the data that caused the error (for example an order's details).
• Legal basis: our legitimate interest in the security of the system (Article 6(1)(f) GDPR).
• Retention period: the web server log is kept for 14 days and then deleted automatically. The application and database logs are overwritten when they reach a fixed size.

3.12. Backups

• Purpose: restoring data in the event of a fault or data loss.
• Data: the entire database of the ticket system (the data in points 3.1–3.5, 3.7, 3.9, 3.15 and 3.16, and the staff accounts).
• Legal basis: our legitimate interest in preserving the integrity of the data, and the security obligation under Article 32 GDPR (Article 6(1)(f) and (c) GDPR).
• Retention period: backups are kept on the server for at most 15 days and then deleted automatically. An encrypted copy is also kept off the server, on Google Drive: there we keep the 2 most recent daily backups, and the system permanently deletes older ones at the next upload. Google may still keep deleted data in its own systems for the period set by the terms of its service. Google does not receive the encryption key. Data already deleted elsewhere is also removed from the backups by the end of the backups' retention period at the latest.

3.13. Internal sales dashboard

• Purpose: tracking sales.
• Data: on a password-protected internal page, our staff see the order number, the time of the order, the tickets, the amount, the status and the discount code redeemed. The page does not show any customer data (name, e-mail address, billing details).
• Legal basis: our legitimate interest in tracking sales (Article 6(1)(f) GDPR).
• Retention period: the page does not store the data separately; it is built from the orders' data (point 3.1).

3.14. Third-party offers

The Travel Assistance package included with the pass and the travel section of the Website point to offers from third parties (for example an airline, a partner hotel or an accommodation provider), and the confirmation e-mail may also contain such a link or discount code. We do not share your data with the third party for this. If you take up an offer (for example by booking on the partner hotel's site), the third party processes the data you give there as an independent controller, in accordance with its own privacy notice. The same applies to a discount redeemed with vendors at the venue.

3.15. The players' Riot IDs

• Purpose: registering the players for the Event's tournament in Riot Games' official tournament system (Riftbound Gaming Network), and ensuring that one Riot ID has one pass for the Event (Terms, point 3.4).
• Data: the Riot ID (game name and tag, e.g. Name#EUNE) of each pass's player, and which ticket it belongs to; if the Buyer changed it, the time of the last change. The Riot ID is also printed on the ticket (PDF), and the scanner shows it at the entrance.
• Where it comes from: the Buyer. If the Buyer buys a pass for another player, the Buyer gives that player's Riot ID too; in that case, please draw the player's attention to this notice (the checkout asks for this too). The player can exercise their rights under point 8 even if they did not buy the pass.
• Changes: the Buyer can change the Riot ID under point 3.4 of the Terms, by a link sent to the order's e-mail address that works for 24 hours. The change page shows all of the order's changeable Riot IDs to whoever opens the link. We overwrite the earlier Riot ID in the database and do not keep it there; tickets attached to e-mails already sent, the backups (point 3.12) and a list already uploaded to the tournament system may still contain it. We record the time of the change on the ticket, so that a list already uploaded can be updated. We store the link in the database only as a fingerprint (hash); it stops working after 24 hours or when a new one is requested. We delete expired links every hour.
• Legal basis: performance of the contract (Article 6(1)(b) GDPR); where the player is not the Buyer, our legitimate interest in carrying out the tournament participation that was ordered (point (f)).
• Recipient: Riot Games (the publisher of Riftbound), into whose tournament system we upload the Riot IDs. Riot Games processes the player's data in its own tournament system as an independent controller, in accordance with its own privacy notice (point 7).
• Retention: for 12 months after the Event ends. For that long we handle appeals, complaints and disputes about the tournament, the passes and the use of the Riot IDs, and to look into them we need to know which Riot ID belonged to which pass. After that we delete the Riot ID and the time of its change from the tickets and the order; we keep the other data of the ticket and the order as set out in points 3.1 and 3.2. The Riot ID leaves the backups within the period in point 3.12. It may remain on tickets attached to e-mails already sent and in the list uploaded to the tournament system; Riot Games keeps the data uploaded to its tournament system under its own rules.

If you do not give the Riot ID, we cannot sell you the pass, as the Main Event seat is tied to a Riot ID.

3.16. Visitor analytics without cookies

• Purpose: to find out how many people visit the Website, how many come back, and roughly from which countries, so that we can see whom news of the Event reaches. Our staff see the results on a password-protected internal page, in real time and broken down by day, in aggregate only (as counts): the page does not show individual visitors.
• How we measure: we do not use cookies and do not store anything in your browser. When you open a page of the Website, your browser sends our server the fact that a page has been opened and the browser's time zone setting (for example ‘Europe/Budapest’); while the page is open and visible, it also sends, once a minute, that it is still open. From your IP address and your browser type (User-Agent), the server forms a fingerprint (hash) with that day's random secret key (hereinafter: the daily key). We use the IP address and the browser type for this in memory only and do not store them with the analytics data; like every request, however, this signal is written to the web server log, where it is kept for 14 days under point 3.11. The IP address cannot be read directly from the fingerprint, and once the daily key has been deleted, the fingerprint can no longer be linked to it in any way. We estimate the country from the time zone, not from the IP address. If your browser sends the Do Not Track or the Global Privacy Control signal, we do not measure your visit.
• Data: per visitor and per day: the fingerprint, the day, the estimated country, the number of pages opened that day, the time of the first and the last signal, and, if the visitor had already been on the Website in the previous 30 days, the last such day. For the latter, the server also computes the fingerprint with the keys of the previous 30 days and checks whether it appears on the day in question. A visitor is whoever comes from the same IP address with the same browser, so the figures are estimates: someone who changes IP address or browser counts as a new visitor, and people arriving from one IP address with the same kind of browser count as one. We do not record the addresses of the pages opened, the referring page or any other data about the browser.
• Legal basis: our legitimate interest in evaluating the Website and the promotion of the Event (Article 6(1)(f) GDPR).
• Retention period: we keep the daily key and that day's fingerprints for 30 days after the day, then delete both, and we also set the times of the first and the last signal to the start of the day. From then on, the remaining data (the day, the estimated country, the number of pages opened and the day of the previous visit) are anonymous statistics that cannot be linked to anyone, and we keep them. The fingerprints are removed from the backups within the period set out in point 3.12.

4. Minors

Purchases are governed by the rules of the Civil Code on legal capacity. On the Website, we do not carry out any processing based on your consent (for example a newsletter).

5. Automated decision-making

We do not carry out automated decision-making or profiling.

6. Data security

• The Website is available only over an encrypted connection (HTTPS).
• Your bank card details do not reach us.
• We store the order's personal link and the Riot ID change link in the database only as a fingerprint (hash). The visitor analytics data do not include the IP address, only the fingerprint formed with the daily key (point 3.16).
• We store the data in a separate environment that runs only the ticket system. Only our authorised staff and the system's operator have access to it; staff carrying out entry control have access only to scanning tickets, and with that to the scanned ticket's data (for a player pass, its Riot ID).
• We make regular backups, and keep the off-server copy encrypted (point 3.12).

7. Who we share data with (processors and recipients)

We operate the Website's server, database and e-mail within the European Economic Area (EEA). The encrypted copy of the backup may also be stored in Google's systems outside the EEA (for example in the United States); Google does not receive the encryption key, so it cannot learn the content of the backup. Such transfers are subject to the safeguards under Chapter V GDPR (the European Commission's adequacy decision on the EU–US Data Privacy Framework, or the standard data protection clauses applied by Google). Paynance's and Adyen's own privacy notices provide information on any transfers of data outside the EEA by them and on the related safeguards. Riot Games may also process the data uploaded to its tournament system outside the EEA, in particular in the United States; Riot Games' privacy notice (https://www.riotgames.com/en/privacy-notice) explains this and the safeguards for the transfer.

8. Your rights

You can exercise your rights using the contact details given in point 1. We reply to your request within one month. Where justified, we may extend this deadline by two months; we will inform you if we do.

• Access: you may ask what data of yours we process, and request a copy of it (Article 15 GDPR).
• Rectification: you may ask us to correct your inaccurate data (Article 16). The details of an invoice already issued can be changed only in accordance with the accounting rules (with a storno invoice and a new invoice).
• Erasure: you may ask us to erase your data if processing it is no longer necessary (Article 17). We cannot erase data that we must keep by law (for example the invoice data) until the end of the retention period.
• Restriction: you may ask us, for a time, only to store your data and not to use it in any other way (Article 18).
• Data portability: you may also request the data we process on the basis of the contract in a machine-readable format (Article 20).

Objection: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (points 3.4, 3.5, 3.8, 3.9, 3.11, 3.12, 3.13, 3.15 and 3.16; Article 21 GDPR). In that case we may continue to process the data only if this is justified by compelling legitimate grounds or the defence of legal claims. You can also object to visitor analytics (point 3.16) by turning on the Do Not Track or the Global Privacy Control signal in your browser: we then do not measure your visit.

9. Remedies

If you feel that we have infringed your data protection rights, please contact us first so that we can remedy the problem. You can also lodge a complaint with the National Authority for Data Protection and Freedom of Information:

• National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH)
• Address: 1055 Budapest, Falk Miksa utca 9–11.
• Postal address: 1363 Budapest, Pf. 9.
• E-mail: ugyfelszolgalat@naih.hu · Telephone: +36 1 391 1400 · Website: https://naih.hu

If your rights are infringed, you can also go to court. You may also bring the action before the regional court (törvényszék) for your place of residence or place of stay.

10. Changes to this notice

We amend this notice when the ticket system or the law changes, for example if we start a newsletter or bring in a new service provider. The version of 2026-10-21 introduced the players' Riot IDs (point 3.15), the version of 2026-10-28 visitor analytics without cookies (point 3.16) and the 30-day login of the internal dashboards. Every version remains available at its own, unchanging address (this version: https://riftbound.delta1.hu/privacy/2026-10-28). With each order, we record which version you read.